Hiera OS X Keychain Backend

A simple Hiera backend for looking up OS X keychain.

This Hiera backend requires OS X, obviously.

Install hiera-osxkeychain gem to the Hiera environment.

gem intall hiera-osxkeychain

In hiera.yaml config file, add osxkeychain backend and specify service name used in keychain. By default, service name is hiera.

:backends:
  - osxkeychain
  ...
:yaml":
  ...
:osxkeychain:
  :service: "hiera"
:hierarchy:
  ...

Create generic password items in OS X keychain with specified service name. Use account name for each Hiera lookup key.

For example, launch Keychain Access.app, then use New Password Item... under File menu. Give hiera (or service name you specified in hiera.yaml) to Keychain Item Name:, Hiera lookup key name to Account Name:, then set Password:.

Try looking up the key from command line.

hiera -c /path/to/hiera.yaml key

You may see a prompt to approve keychain access from security command.

Since keychain is a simple flat secure key-value storage, currently it doesn't support hierarchy. Also doesn't support interporations on the value, which I believe shouldn't be used in the situation of keychain usage.